Vulnerability Description
SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/SIPp/sipp
- https://github.com/SIPp/sipp/blob/v3.7.7/src/sip_parser.cpp#L76-L113
- https://github.com/SIPp/sipp/commit/ddf22d1a54e0396b2e18ebaf4cf5a3fa860e5da4
- https://github.com/SIPp/sipp/pull/879
- https://www.vulncheck.com/advisories/sipp-through-3.7.7-buffer-overflow-via-sip-
FAQ
What is CVE-2026-90778?
CVE-2026-90778 is a vulnerability with a CVSS score of 7.5 (HIGH). SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can se...
How severe is CVE-2026-90778?
CVE-2026-90778 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-90778?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.